Diego Rodrigues de Sa e Souza 5f0cf313a5 fix(security): redact public Firebase Web key from windsurf spec; doc SHA-256 cache-key rationale (#2894) ...

Two security-scanning findings on release/v3.8.6:

- Secret-scanning alert 7 (google_api_key): the windsurf login-fix design spec
  embedded the literal public Firebase Web API key on two lines. Firebase Web
  API keys are non-sensitive by design (they identify the project; access is
  gated by Firebase Security Rules + key restrictions), but the literal trips
  secret scanning. Redacted to a placeholder; the embedded default still goes
  through resolvePublicCred per rule #11.

- Code-scanning alert 261 (js/insufficient-password-hash): tokenCacheKey() uses
  SHA-256 to derive an in-memory cache key from the session token, not for
  password-at-rest storage. Added a comment documenting why CWE-916 KDFs do not
  apply (false positive).

2026-05-29 08:42:58 -03:00

..

plans

docs(plan): Phase 1 windsurf login hotfix implementation plan

2026-05-29 12:31:39 +08:00

specs

fix(security): redact public Firebase Web key from windsurf spec; doc SHA-256 cache-key rationale (#2894)

2026-05-29 08:42:58 -03:00